Biometric security encryption system

ABSTRACT

A method of registering biometric data is disclosed wherein a number of instances of input biometric data are accepted from a new user during a registration process. Each of these data samples are compared against existing templates to identify those templates posing a significant risk of confusion with a data sample. Those templates are identified and information relating to those templates is stored with the enrolled template of the new user. When a user is identified as the new user, the system automatically verifies that the data sample does not also result in identification as one of the identified templates.

This is a continuation-in-part of U.S. patent application Ser. No.08/760,228, filed Dec. 4, 1996, now abandoned. This is also acontinuation of U.S. patent application Ser. No. 08/804,267 filed Feb.21, 1997, now U.S. Pat. No. 6,038,334 and a continuation of U.S. patentapplication Ser. No. 08/899,704 filed on Jul. 24, 1997, now U.S. Pat.No. 6,072,891.

FIELD OF THE INVENTION

This invention relates generally to identification of individuals andmore particularly relates to a method of selecting a biometric templatefor identification of individuals.

BACKGROUND OF THE INVENTION

Computer security is fast becoming an important issue. With theproliferation of computers and computer networks into all aspects ofbusiness and daily life—financial, medical, education, government, andcommunications—the concern over secure file access is growing. A commonmethod of providing security is using passwords. Password protectionand/or combination type locks are employed for computer networksecurity, automatic teller machines, telephone banking, calling cards,telephone answering services, houses, and safes. These systems generallyrequire the knowledge of an entry code that has been selected by a useror has been preset.

Preset codes are often forgotten, as users have no reliable method ofremembering them, Writing down the codes and storing them in closeproximity to the access control device (i.e. the combination lock)results in a secure access control system with a very insecure code.Alternatively, the nuisance of trying several code variations rendersthe access control system more of a problem than a solution.

Password systems are known to suffer from other disadvantages. Usually,a user specifies a password. Most users, being unsophisticated users ofsecurity systems, choose passwords that are relatively insecure. Assuch, many password systems are easily accessed through a simple trialand error process.

A security access system that provides substantially secure access anddoes not require a password or access code is a biometric identificationsystem. A biometric identification system accepts unique biometricinformation from a user and identifies the user by matching theinformation against information belonging to registered users of thesystem. One such biometric identification system is a fingerprintrecognition system.

In a fingerprint input transducer or sensor, the finger underinvestigation is usually pressed against a flat surface, such as a sideof a glass plate; the ridge and valley pattern of the finger tip issensed by a sensing means such as an interrogating light beam.

Various optical devices are known which employ prisms upon which afinger whose print is to be identified is placed. The prism has a firstsurface upon which a finger is placed, a second surface disposed at anacute angle to the first surface through which the fingerprint is viewedand a third illumination surface through which light is directed intothe prism. In some cases, the illumination surface is at an acute angleto the first surface, as seen for example, in U.S. Pat. Nos. 5,187,482and 5,187,748. In other cases, the illumination surface is parallel tothe first surface, as seen for example, in U.S. Pat. Nos. 5,109,427 and5,233,404. Fingerprint identification devices of this nature aregenerally used to control the building-access or information-access ofindividuals to buildings, rooms, and devices such as computer terminals.

U.S. Pat. No. 4,353,056 in the name of Tsikos issued Oct. 5, 1982,discloses an alternative kind of fingerprint sensor that uses acapacitive sensing approach. The described sensor has a two dimensional,row and column, array of capacitors, each comprising a pair of spacedelectrodes, carried in a sensing member and covered by an insulatingfilm. The sensors rely upon deformation to the sensing member caused bya finger being placed thereon so as to vary locally the spacing betweencapacitor electrodes, according to the ridge/trough pattern of thefingerprint, and hence, the capacitance of the capacitors. In onearrangement, the capacitors of each column are connected in series withthe columns of capacitors connected in parallel and a voltage is appliedacross the columns. In another arrangement, a voltage is applied to eachindividual capacitor in the array.

Sensing in the respective two arrangements is accomplished by detectingthe change of voltage distribution in the series connected capacitors orby measuring the voltage values of the individual capacitances resultingfrom local deformation. To achieve this, an individual connection isrequired from the detection circuit to each capacitor.

Before the advent of computers and imaging devices, research wasconducted into fingerprint characterisation and identification. Today,much of the research focus in biometrics has been directed towardimproving the input transducer and the quality of the biometric inputdata. A second important issue to be addressed is the identificationprocess itself and more particularly, the registration process.

A common method of registering users for a biometric identificationsystem is to capture biometric input information, characterise it, andstore it as a template. The same user then provides biometric inputinformation to the system for identification. This is repeated severaltimes and if identification is successful, the user and their biometrictemplate are registered. Further, the system requires an experiencedoperator to accept or reject instances of biometric information intendedas templates.

A further method of registering users for a biometric identificationsystem is to capture a plurality of instances of biometric inputinformation from a same user and to characterise each instance. Acomposite biometric template is then constructed in dependence upon theplurality of instances provided. Such a system is complicated and itrequires an experienced operator to accept or reject instances ofbiometric information intended for template construction.

OBJECT OF THE INVENTION

It is an object of this invention to provide a means of selecting abiometric template or biometric information from which to derive atemplate.

It is an object of the invention to provide a method of training usersto more effectively use biometric identification systems.

SUMMARY OF THE INVENTION

In accordance with the invention there is provided a method ofidentifying an individual presenting a biometric information source to asystem. The method comprises the steps of:

receiving a biometric information sample from the biometric informationsource of the individual;

characterising the biometric information sample;

comparing the characterised biometric information sample against some ofa plurality of stored templates to identify a template that closelymatches the characterised biometric information sample;

determining further templates from the plurality of stored templates,the further templates determined from data associated with theidentified template;

comparing the characterised biometric information sample against atemplate from the further templates to determine a likelihood that thecharacterised biometric information sample closely matches the templatefrom the further templates; and

identifying the individual when a match between the characterisedbiometric information sample and the template from the further templateshas a likelihood outside a first range of likelihoods.

In accordance with the invention there is provided a method performingone of user authorisation and user identification for use in a systemwherein biometric data are stored in a database. The method comprisesthe steps of:

providing a biometric information sample;

comparing data based on the biometric information sample and thebiometric data to locate data within the biometric data that isindicative of a substantial match with the biometric information sample;

determining further information from data associated with the locateddata indicative of a substantial match, the further data indicative ofbiometric data that has a known potential for indicating falseacceptance; comparing the data based on the biometric information sampleand the further data from the database to provide comparison results;and,

when the comparison results are indicative of no further substantialmatches with the biometric information sample, performing at least oneof user authorisation and user identification.

In accordance with the invention there is provided a method ofidentifying comparisons indicative of potential false for use in asystem wherein biometric data are stored in a database. The methodcomprises the steps of:

comparing data based on a biometric information sample associated withfirst data within the biometric data and the biometric data to locatesecond data within the biometric data that is indicative of asubstantial match with the biometric information sample to providecomparison results; and,

when a comparison result is indicative of a substantial match and thesecond data is other than the first data, storing information inassociation with the first data the information indicative of the seconddata.

In accordance with the invention there is provided a method of storingdata relating to biometric information in a database for use inidentifying individuals. The method comprises the steps of:

storing data associated with a first biometric information sample and acorresponding identification; and,

storing a list of data associated with other biometric informationcorresponding to other identifications within the database, some of thebiometric data associated with the other biometric information having asignificant similarity to data associated with the first biometricinformation sample.

In accordance with the invention there is provided a method ofregistering biometric information from a source, comprising the stepsof:

providing an instance of biometric information from the source;

storing a template relating to the provided biometric information in adatabase comprising a plurality of templates;

comparing the biometric information against a further template todetermine a likelihood that the biometric information matches thefurther template;

when the likelihood is within a first range of likelihoods, storing datarelating to the further template in association with the data based onthe biometric information.

In an embodiment when the likelihood is within the first range oflikelihoods, storing data relating to a biometric information sourceselected so as to distinguish between the provider of the previouslystored biometric information and the provider of the biometricinformation from which the further template is determined.

In accordance with the invention there is provided a method providing aninstance of biometric information from the source;

storing a template relating to the provided biometric information in adatabase comprising a plurality of templates;

comparing previously stored biometric information against the storedtemplate to determine a likelihood that the previously stored biometricinformation matches the stored template; and,

when the likelihood is within a first range of likelihoods, storing datarelating to the previously stored biometric information associated withthe data based on the biometric information.

The advantages of a system in accordance with this invention arenumerous. For example, registration of authorized users requires littletime and expense. The chance of deriving a biometric template from poorbiometric information is greatly reduced.

BRIEF DESCRIPTION OF THE DRAWINGS

An exemplary embodiment of the invention will now be described inconjunction with the attached drawings, in which:

FIG. 1a is a representation of a fingerprint image captured by anoptical fingerprint imaging means;

FIG. 1b is a representation of another instance of a fingerprint imagecaptured by an optical fingerprint imaging means imaging the samefingertip as that of FIG. 1a;

FIG. 1c is a representation of another instance of a fingerprint imagecaptured by an optical fingerprint imaging means imaging the samefingertip as that of FIG. 1a;

FIG. 2 is a flow diagram of a method of selecting a biometric templaterequiring 3 different biometric data sets in accordance with theinvention;

FIG. 3 is a flow diagram of a further method of selecting a biometrictemplate requiring n biometric data sets;

FIG. 4 is a flow diagram of a method of training users of a biometricinput system according to the invention;

FIG. 5 is a flow diagram of a method reducing false acceptance(incorrect registration) of users of a biometric identification systemaccording to the invention;

FIG. 6 is a flow diagram of a method of identifying the source ofbiometric input information in a system employing the method shown inthe flow diagram of FIG. 5;

FIG. 7 is a chart showing results from registrations using each of thefingerprint images of FIGS. 1a, 1 b, and 1 c as templates and the othersas biometric input information;

FIG. 8 is a flow diagram of a method of providing biometric informationaccording to the invention;

FIG. 8b is a flow diagram of a method of providing biometric informationand identifying a user in dependence thereon according to the invention;

FIG. 9 is a simplified diagram of a user interface for enteringparameters according to the invention;

FIG. 9a is a simplified diagram of FIG. 9 with some parameters selectedfor entry;

FIG. 9b is a simplified diagram of a display having prompts thereonrequesting provision of biometric information from predeterminedbiometric information sources;

FIG. 10 is a flow diagram of another method of providing biometricinformation and identifying a user in dependence thereon according tothe invention;

FIG. 11 is a flow diagram of another method of providing biometricinformation and identifying a user in dependence thereon according tothe invention;

FIG. 12 is a flow diagram of another method of providing biometricinformation and identifying a user in dependence thereon according tothe invention;

FIG. 13 is a flow diagram of another method of providing biometricinformation and identifying a user in dependence thereon according tothe invention;

FIG. 14 is a flow diagram of another method of providing biometricinformation and identifying an individual in dependence thereonaccording to the invention;

FIG. 15 is a flow diagram of another method of providing biometricinformation and identifying an individual in dependence thereonaccording to the invention;

FIG. 16 is a probability distribution curve for individualidentification using a biometric information sample;

FIG. 17 is a two dimensional probability distribution surface forindividual identification in dependence upon a plurality of biometricinformation samples; and

FIG. 18 is a flow diagram of another method of providing biometricinformation and identifying an individual in dependence thereonaccording to the invention.

DETAILED DESCRIPTION

The invention will be described with respect to finger printregistration. The method of this invention is useful in other biometrictemplate selection processes as well.

Referring to FIGS. 1a, 1 b, and 1 c, a fingerprint is shown. Afingerprint is substantially unique and is identifiable by a series ofcriteria. These criteria include core size, core type, location ofminutia, ridge spacing, ridge type, etc. Each feature can be located andstored for later registration of unknown prints. Unfortunately,accurately mapping out all features and determining registration basedon partial prints and skewed prints is very time consuming; and, it isbeneficial to minimize the time required to register a print. Therefore,not all features are analyzed to register each print.

A comparison of the fingerprint of FIG. 1a, FIG. 1b, and FIG. 1c willshow them to have a same source; however, a comparison of the imagesdirectly is difficult, as they are each different. Each time a personplaces a fingertip onto a fingerprint scanner, a slightly differentimage is captured. From one instance to another a fingerprint may beshifted, skewed, cover different parts of the fingertip or be appliedwith different pressure. Since each captured image is substantiallyunique, it is likely that some images form better templates forregistration than others. A method of selecting those fingerprints thatform better templates is herein disclosed.

Referring to FIG. 2 a flow chart of a method according to the presentinvention is shown. Three instances of biometric information in the formof finger prints are captured. As shown in the flow diagram, eachinstance is captured individually. Preferably all instances are capturedin such a way as to simulate normal use. For example, when using afingerprint sensor for unlocking a door, a person steps up to the doorand presses their finger tip against the sensor. The person then stepsaway from the door and approaches the door from a second differentangle. In this way, the fingerprints imaged by the sensor will betterreflect a variety of possible fingerprints from a same user duringnormal operation and each captured image is independent, excepting therelation to a known fingertip.

Preferably, an operator ensures that each image is a “good fingerprint”prior to storing the image for characterization. Operator skill is notrequired when using the method of this invention, but may result in animproved template.

Each fingerprint is then characterized. Fingerprint characterization iswell known and can involve many aspects of fingerprint analysis. Theanalysis of fingerprints is discussed in the following references, whichare hereby incorporated by reference:

Xiao Qinghan and Bian Zhaoqi: An approach to Fingerprint IdentificationBy Using the Attributes of Feature Lines of Fingerprint,” IEEE PatternRecognition, pp 663, 1986 C. B. Shelman, “FingerprintClassification—Theory and Application,” Proc. 76 Carnahan Conference onElectronic Crime Countermeasures, 1976.

Feri Pernus, Stanko Kovacic, and Ludvik Gyergyek, “Minutaie BasedFingerprint Registration,” IEEE Pattern Recognition, pp 1380, 1980.

J. A. Ratkovic, F. W. Blackwell, and H. H. Bailey, “Concepts for a NextGeneration Automated Fingerprint System,” Proc. 78 Carnahan Conferenceon Electronic Crime Countermeasures, 1978.

K. Millard, “An approach to the Automatic Retrieval of LatentFingerprints,” Proc. 75 Carnahan Conference on Electronic CrimeCountermeasures, 1975.

Moayer and K. S. Fu, “A Syntactic Approach to Fingerprint PatternRecognition,” Memo Np. 73-18, Purdue University, School of ElectricalEngineering, 1973.

Wegstein, An Automated Fingerprint Identification System, NBS specialpublication, U.S. Department of Commerce/National Bureau of Standards,ISSN 0083-1883; no. 500-89, 1982.

Moenssens, Andre A., Fingerprint Techniques, Chilton Book Co., 1971.

Wegstein and J. F. Rafferty, The LX39 Latent Fingerprint Matcher, NBSspecial publication, U.S. Department of Commerce/National Bureau ofStandards; no. 500-36, 1978.

Using the method of the present invention, a same characterizationmethod is employed in characterizing each fingerprint. This allows forcomparisons between characterized images. Alternatively, a series ofcharacterizations are performed on each fingerprint to determine a bestfingerprint from which to select the template and a bestcharacterization for the template. Use of multiple characterizationsincreases the overhead required to characterize a fingerprint duringnormal use. It will be apparent to those of skill in the art that whenmultiple characterizations are employed, only similarly characterizedfingerprints are compared. The remainder of this description assumes theuse of only one form of characterization.

Each characterized image is selected, one at a time, and all othercharacterized images are registered against the selected characterizedimage. The selected characterized image acts as a template and theremaining characterized images act as user input biometric information.This results in six registrations. For each characterized image (servingas a template) a score is achieved. The score is based on thecorrelation between the characterized image (as template) and the othercharacterized images. The six registrations produce six differentscores, two for each characterized image, which are compared.Alternatively, the scores for each characterized image, as template areadded or averaged. The characterized image with the most desirablescore(s) is selected to be the template. The score(s) is(are) thencompared to a threshold value to determine suitability. When suitable,the image and the characterized image are stored and form the biometricinformation registration template. Alternatively, only the characterizedimage is stored. When the scores are not suitable, the characterizedimages are discarded and the method is followed again. Alternatively,only some characterized images are discarded and others are stored; themethod is reapplied capturing only as many new images as are necessaryin order to select a template.

In an alternative embodiment shown in FIG. 3, n instances of biometricinformation in the form of fingerprints are captured. Preferably, thecaptured images are independent as described above. Each image ischaracterized to produce a characterized image. At least some of thecharacterized images are selected. Against each of the characterizedimages selected, some other characterized images are registered. Shouldall characterized images be selected and compared against all otherimages, the number of resulting comparisons is (n) (n−1). For eachregistration, a resulting score is associated with the selectedcharacterized image. The scores associated with each selectedcharacterized image are compared and a characterized image with a mostdesirable set of scores is identified. The scores of the identifiedcharacterized image are verified against a threshold value to ensurethat the identified characterized image is acceptable and the identifiedcharacterized image and the associated image are stored as a template.Alternatively, only the identified characterized image is stored as atemplate.

Alternatively, n instances of biometric information in the form offingerprints are captured as shown in FIG. 3 and m further instances ofbiometric information in the form of fingerprints are provided.Preferably, the further images are selected to ensure a selectedbiometric template is unlikely to result in false registrations. Theselection of the m instances is based on false authorizations that haveoccurred with some templates. Alternatively, the selection of the minstances is based on the characterization of the n images.Alternatively, the selection of the m instances is based on a randomselection. Against each of the characterized images from the ninstances, some other characterized images are registered, as arecharacterized images from the m instances. For each registration, aresulting score is associated with the selected characterized image.Scores indicative of similarities are desirable for registrations withcharacterized images from the n instances. Scores indicative ofdifferences are desirable for characterized images from the m instances.The scores associated with each selected characterized image arecompared and a characterized image with a most desirable set of scoresis identified. Desirability of a set of scores is dependent on apredetermined level of security and on an application in which biometricidentification is being used. The scores of the identified characterizedimage are verified against a threshold value to ensure that theidentified characterized image is an acceptable template. Preferably,the template results in no authorization of instances from the minstances.

Preferably, the same characterized images are registered against eachtemplate. Further preferably, the scores are added or averaged.

Alternatively, the characterized image is modified prior to storing it.The modifications include removing features that failed to match similarfeatures in at least some of the other characterized images. In thisway, false features are reduced and improved registration results.

Most biometric identification systems work most effectively when usersprovide similar biometric input information each time they access asystem. False rejections often result from inexperienced users of abiometric input device and more specifically from poor presentation ofbiometric information.

Referring to FIG. 4, a further use of a method according to thisinvention is automated training of users of biometric identificationsystems. A user provides a plurality of biometric input samples to asystem. The system selects a sample as a template according to thepresent invention and reports on the resulting selected template and theresulting score(s). A first sample is discarded and replaced by a newsample. This is repeated for several trials until the template and thescore(s) are substantially similar between trials. Given that the scoreexceeds a predetermined threshold, it is likely that the user isproviding biometric input information to the system that is useable foruser identification.

In using biometric information in the form of fingerprint images foruser identification, false registration is a great concern. Often, falseregistration is a function of the biometric information and not an“error” on the part of an identification system. Two different users mayshare many common features in their biometric information, andtherefore, each may register as the other. In selecting templates, itwould be advantageous to reduce false registration as much as possible.

Referring to FIG. 5, a method of using the present invention forreducing false registration is presented. Templates are selectedaccording to a known method of selecting same. A plurality of images arecaptured for each individual having a template. The images are eachcharacterized and their characterizations are stored. Each image isregistered against every template to identify potential falseacceptance. For large systems, such a task is very time consuming andwould be best executed as a background task. When a possible falseregistration is identified, a further template is selected (from theimages and characterized images) to distinguish between correct andfalse registration. An identifier of the further template is stored withthe original template in a hierarchical fashion. The identifier, forexample, is in the form of an identification of the biometricinformation source. Optionally, information relating to the templateidentified as having a potential for false registration is also stored.The task executes until all images have been registered against alltemplates. Thus, when an acceptance occurs, the system has informationthat none of a plurality potential false acceptances has occurred. Theresulting reliability of the system is thereby improved. When a verylarge number of users are enrolled, such an improvement is statisticallysignificant.

Referring to FIG. 6, a flow diagram of a method of identifying a user independence upon biometric input information is shown for a systememploying a method of reducing false registration as described withreference to FIG. 5. A user provides biometric information in the formof a fingerprint image. The image is characterized. The characterizedimage is compared against templates to locate user information. When aregistration occurs (a template is sufficiently similar to the biometricinformation provided) the system verifies that false registration isunlikely. When false registration is unlikely, registration is complete.When it is likely, the biometric information provided is compared totemplates corresponding to each potential false registration associatedwith the registered template. When no further registration occurs, theregistration process is complete.

When a further registration occurs, the registration process selects atleast another template against which to verify the provided biometricinformation. This at least another template is stored associated withthe templates against which registration has occurred. Selecting andstoring the further template is described above with reference to FIG.5. The further template improves the probability of distinguishingbetween each of the two potential false registrations identified.

Referring to FIG. 7, correlation results are shown for the fingerprintsof FIG. 1a, FIG. 1b, and FIG. 1c. The results indicate that registeringa fingerprint on a second fingerprint is not commutative. As such, thenumber of registrations required to select a template can not be reducedby registering each pair only one time. Of course, when a commutativeregistration algorithm is used, each pair only requires a singlecomparison.

Alternatively, the method is employed with retinal scanned biometricinformation. Further alternatively, the method is employed with palmprints. Further alternatively, the method is employed with non imagebiometric data such as voice prints.

Distinguishing Between Multiple User Identities

One of the problems with a finger print biometric is that a segment ofthe population can have temporary or permanent skin conditions whichcause poor image quality on the scanning device which in turn causesthem to experience high false rejection rates. By allowing candidates touse more than one finger during authentication, lower thresholds forauthentication are combined in a way which confirms identities yet doesnot compromise the level of false acceptances for the system.

Thresholds from a set of distinct fingerprints from a candidate thatwould usually be rejected for being too insecure are combined accordingto this method to allow acceptance in dependence upon a plurality ofbiometric information samples. Thus a candidate lowers the chance ofbeing falsely rejected by supplying multiple biometric informationsamples in the form of fingerprints for authentication.

Referring to FIG. 8, a flow diagram of an method of improvingidentification by using multiple biometric information samples is shown.Biometric information in the form of fingerprints is provided to aprocessor. According to the invention, a plurality of samples from atleast two biometric information sources is provided. These samples arein the form of fingerprints, palm prints, voice samples, retinal scans,or other biometric information samples.

Requiring an individual to enter biometric information samples from atleast two biometric information sources allows for improved registrationresults and reduced false acceptance. For example, some individuals areknown to be commonly falsely accepted or identified as taught above. Thefalse acceptance taught above is a result of similarities betweenbiometric information samples from a biometric information source of aregistered individual and from a biometric information source of anotherregistered individual. These similarities are often only present for aspecific similar biometric information source such as a left indexfinger or a right thumb. The provision and registration of two biometricinformation samples, reduces likelihood of similarity because, wherebefore similarity of a single biometric information source resulted infalse acceptance, now similarity in two different sources is unlikely.Therefore, requiring a minimum of two biometric information sourcesreduces a likelihood of false acceptance. The use of a plurality ofvaried biometric information sources in the form of retinal scans, voiceprints, finger prints, palm prints, toe prints, etc. further reducesprobability of false registration; it is unlikely that the variedbiometric information from two individuals is similar.

Similarly, requiring an individual to enter biometric informationsamples from at least two biometric information sources reduces theprobability of false rejection. As the likelihood of false acceptancedecreases, a lower threshold for acceptance becomes acceptable. Bothfalse rejection and false acceptance are thereby reduced or, in otherwords, probability of accurate identification is improved. It is common,in building access systems to maintain a database of individuals withinthe building and to deny those individuals access to the building asecond time. In accordance with one embodiment of the present invention,decreasing false rejection is achieved by allowing a system todistinguish between users currently within and those currently outside abuilding even when biometric information from one or more biometricinformation sources is similar.

Each biometric information sample is associated with a biometricinformation source in the form of a fingertip, a retina, a voice, apalm, etc. The association allows for comparison between the biometricinformation sample and a template associated with the biometricinformation source. When an individual's identity is provided to theprocessor or is known, the biometric information sample is only comparedto a single template associated with the biometric information source.Alternatively, the biometric information sample is compared against aplurality of templates. Comparing biometric information samples is oftenreferred to as registering the biometric information samples. Manymethods are known for performing the registration. Commonly, thebiometric information sample is characterized according to a methodspecific to the template. The template and the characterized biometricinformation sample are compared to determine a registration value. Theregistration value is then used to determine identification; to provideaccess to a system or structure; to log access; to monitor use; forbilling; or for other purposes.

When an individual's alleged identity is not provided to the processoror known to the processor, the characterized biometric information isregistered against templates stored in a database of templates in orderto locate those registrations which are indicative of a predeterminedcharacteristic. The characteristic is often identity but othercharacteristics are also known. Because a plurality of biometricinformation samples is provided, the registration against templates isfor locating a plurality of templates that are indicative of apredetermined characteristic. When the characteristic is identity, thetemplates are from a same individual and the registration process triesto locate a set of templates that registers with the characterizedbiometric information samples resulting in a set of values indicative ofaccurate identification.

Referring to FIG. 8b, a flow diagram of an embodiment of the inventionfor identifying an individual is shown. An individual seekingauthentication by a user authorization system is presented with aparameter entry means. Parameter entry means are well known in the artof computer science. Some examples of parameter entry means includededicated switches; software for execution on a processor and forproviding an individual with means for selecting or customizingparameters in the form of prompts, a command line, or a graphical userinterface; cards or other storage means for provision to a devicecapable of reading stored parameters and providing them to a processor;wireless data entry; and voice data entry systems.

Using the parameter entry means, the individual determines biometricinformation sample parameters. The parameters are selected from a knowngroup of available parameters. Examples of known groups of biometricinformation samples include (right index finger, left index finger, leftthumb); (right index finger, voice); (retinal scan, voice); (left thumb,left middle finger); etc. Groupings reduce user entry requirements;however, groupings also reduce flexibility. Alternatively, parametersare entered when an individual selects from all available parameters inorder to determine a group. For example, an individual is presented witha graphical display, as shown in FIG. 9, of biometric informationsources in the form of fingers 11 and selects a number of samples foreach source. When a voice recognition system is incorporated into theuser authorization system, an icon 12 representing voice is alsodisplayed. When a retinal scanning system is incorporated, an icon 13representing the retinal scan is displayed. Other icons are displayedwhen corresponding biometric identification systems are present. Theindividual enters parameters in the form of identifying biometricinformation sources and for each source a quantity of samples beingprovided.

Preferably a minimum set of requirements exist which, though flexible,ensures sufficient levels of security. Requiring each individual toenter information from a minimum number of biometric information sourcesand perhaps a maximum number of samples from a same biometricinformation source allows for maintenance of at least a predeterminedsecurity level.

Once the parameters have been entered, the individual enters biometricinformation into the system in accordance with the parameters.Preferably, the parameters once selected are sent to a processor foranalysis and the individual is prompted to enter each biometricinformation sample. Alternatively, the parameters and the biometricinformation are sent to a processor together.

The biometric information provided by the individual is related to theparameters selected. For example, referring to FIG. 9a, when theindividual selects left ring finger once, right thumb once, and rightindex finger once, the individual then provides a sample of afingerprint from the left ring finger, a fingerprint sample from theright thumb and a fingerprint sample from the right index finger.Prompting, shown in FIG. 9b, allows the individual to select verycomplicated sets of biometric information sources or to select frompredetermined sets without remembering the parameters and/or an orderfor the parameters.

A biometric input means in the form of a live fingerprint scanningdevice is used to collect the biometric information in the form ofimages of fingerprints of the individual which are entered in apredetermined order. Each biometric information sample is identified.When the individual is prompted for a biometric information sample, theprocessor labels the samples. Alternatively, an individual entersparameters and biometric information simultaneously by entering abiometric information sample and identifying the sample as, for example,a specific fingerprint or a voice sample. Optionally, the individual isprovided with a means of reviewing and accepting or discarding biometricinformation samples.

The authentication procedure determines an independent sequence ofcomparison scores from the input provided by the candidate. Thissequence is considered to be a point, hereinafter referred to as P, inn-dimensional vector space, R^(n). A threshold function h_(α): R^(n→)Ris used to determine whether or not the point belongs to a set U_(α) byPεU_(α)⇄h_(α)(P)≧C_(α). The identity of the individual is confirmed ifand only if PεU_(α).

Since the sequence is independent, it is also applicable piecewisethrough evaluation of a single biometric information sample and then,should the first sample provide insufficient likelihood of an accurateidentification, provision and evaluation of subsequent biometricinformation samples follows. Further, the information resulting from thefirst evaluation is useful in assessing which biometric informationsamples will best distinguish between known individuals.

The biometric information sample identifiers are used to uniquelyidentify the input samples. Let I be the set of input images,I={I_(i)|1≦i≦N}. For I_(i)εI, let Id_(i) be the identifier of an image,let T_(i) be the characterization or template of the image, and letT_(i)* be the reference template of the image.

Define the equivalence relation ≡, on the set I by

I _(i) ≡I _(j) ⇄Id _(i) =Id _(j);

The sets

H _(k) ={I _(i) |I _(i) ≡I _(k)}

are equivalence classes that partition the set of input images into setsof images that belong to a same finger tip. There are n of these classeswhere 1≦n≦N.

When τ is a set of all fingerprint templates generated by a givencharacterization algorithm and score: τ×τ→R is the measure generated byan associated matching algorithm, then we can construct a set of classrepresentative, I_(R), which contains one representative for each H_(k):

I _(R) ={I _(j) εH _(k)|score(T _(j) , T _(j)*)=max {score(T _(i) , T_(i)*)},1≦k≦N}

 I _(i) εH _(k)

The set I_(R) ⊂I, is then a set of images of the distinct inputfingerprints that achieve the highest scores. Alternatively, multiplesamples of a same fingerprint are considered. For each I_(i)εI_(R),1≦i≦n, let x_(i)=score(T_(i), T_(i)*) correspond to scores from thematching algorithm. Any ordering of these scores is a point in thevector space R^(n), simply by constructing the n-tuple (x₁, x₂, . . . ,x_(n))=P.

Essentially, as shown in FIG. 8, once a set of parameters is selected, agraphical distribution of identifications is achievable in n-dimensions.The biometric information samples are provided to a processor.Registration is conducted against known templates in dependence upon theselected parameters. Once registration is complete, a single point isdetermined having coordinates equal to each of at least some of theregistration results. Alternatively, the point has coordinatesdetermined in dependence upon the registration results but not equalthereto. Plotting the point results in a point plotted in n-dimensionalspace. The processor then determines a probability distribution for theselected parameters. Alternatively, this is performed prior to theregistration process for biometric information samples. Furtheralternatively, the probability distributions are determined orapproximated in advance and stored in non-volatile memory.

Given an n-dimensional plot defined by a boundary function and a singlepoint, a comparison determines whether or not the point falls below orabove the function and optionally within or outside other known ranges.Stated differently, the point is analyzed to determine whether it fallswithin a suitable region wherein region is defined as an n-dimensionalregion having at least some known boundaries. When the point fallswithin a predetermined or suitable region, the individual is identified.When the point falls outside the predetermined or suitable region, theindividual is not identified. The identification system then respondsaccordingly. Responses in the form of locking an individual out, denyingan individual access, logging an attempted entry by an unidentifiedindividual, etc. are well known and are beyond the scope of the presentinvention.

Referring to FIG. 10, a simplified flow diagram of another embodimentfor user identification is shown. Biometric information samples areprovided to a processor and associated with their biometric informationsources in the form of finger tips, eyes, palm, or voice. The biometricinformation samples and the associated information are provided to aprocessor. The processor characterises the biometric information samplesand registers them against templates. When the individual's allegedidentification is known, registration is performed against templatesassociated with the individual and associated with same biometricinformation sources. Identification of an individual is conducted in afashion similar to that set out for FIG. 8b above. Once a user isidentified, data relating to the user and to a likelihood of falseacceptance is read. The identification is used with the data todetermine whether further biometric information samples are required.For example, when the data comprises identities of other users whosebiometric information is similar to that of the identified user, acomparison of templates of each of the other users and the characterisedbiometric information indicates whether any of the other users is also apotential match. In an alternative embodiment, with each user identityis included a similarity indication to allow a determination of whetherthe identification with its known likelihood poses a significantpossibility of false identification for said user identity. Thus, onlyuser identities having a likelihood of being falsely accepted areverified. Of course, depending on the amount of data relating to eachpossible error in identification, different responses occur.Essentially, it is significant that information relating to errors inidentification that have or could occur is stored with an identificationand is then used to improve the identification results.

In an embodiment, when a system in the form of a door access system haslimited input and output capabilities, each biometric information sampleis verified against a pertinent portion of the database of biometrictemplates. For access, for example, the pertinent portion comprises allindividuals outside the secured area secured by the door. Upon provisionof a first sample, the pertinent portion of the database is restrictedto those individuals with a likelihood of having provided the firstsample. This portion is likely substantially smaller than the previouspertinent portion. When the current pertinent portion comprises morethan one individual or when the individual is identified with alikelihood that is insufficient for maintaining system security, moresamples are required.

In use of a doorway system, three LEDs can provide sufficientinformation for use of the system. A green LED indicates identification,a red LED indicates rejection and a yellow LED prompts for a furtherbiometric information sample. Of course, the selection of LED coloursand the design of a user interface are in accordance with a particularapplication. Even for a doorway, any of a number of user interfacedesigns is compatible with the present invention.

Referring to FIG. 11, a simplified flow diagram of another methodaccording to the invention is shown. A processor prompts an individualfor biometric information samples associated with biometric informationsources selected by the processor according to a predeterminedalgorithm. The predetermined algorithm uses data within the biometricinformation database to determine those individuals who are potentiallymisidentified with better than a predetermined likelihood. Samples arethen selected to avoid misidentification as much as possible. Of course,statistical analysis of the database may provide sufficient informationto determine a set of biometric information samples that is sufficientfor all enrolled individuals. When the set is sufficiently small, itsuse may lend convenience and added security to the entire system.Optionally, the predetermined algorithm selects the biometricinformation sources in dependence upon a likely identity of the user.The biometric information samples are provided to the processor. Theprocessor characterises the biometric information samples and registersthem against templates. When the individual's alleged identification isknown, registration is performed against templates associated with thesame biometric information sources of the individual and againsttemplates associated with those individuals who are potentiallymisidentified with better than a predetermined likelihood.

Referring to FIG. 12, a simplified flow diagram of another methodaccording to the invention is shown. Biometric information samples andassociated parameters are provided to a processor. The processorcharacterises the biometric information samples and registers themagainst templates. When the individual's alleged identification isknown, registration is performed against templates associated with theindividual and associated with same biometric information sources.Identification of an individual is performed by evaluating resultingvalues from the registration to determine, for those resulting values, aprobability of false acceptance and false rejection. The probability offalse acceptance is evaluated based on data stored in association withdata relating to the individual, the stored data indicative of otherindividuals whose data is likely to register when the individual's datais in registration. The probability of false acceptance is furtherevaluated by comparisons with data associated with the otherindividuals. When the values are within predetermined limits for anacceptable value, identification is provided. When the value fallsoutside the predetermined limits identification is not provided.

Referring to FIG. 13, a simplified flow diagram of another methodaccording to the invention is shown. Biometric information samples andassociated parameters including an alleged identification of theindividual are provided to a processor. The processor characterises thebiometric information samples and registers them against templates. Whenthe individual's alleged identification is known, registration isperformed against templates associated with the individual andassociated with same biometric information sources. Identification of anindividual is performed by evaluating resulting values from theregistration to determine a probability, for those results, of falseacceptance and false rejection. The probability of false acceptance isevaluated based on data stored in association with data relating to theindividual indicative of other individuals whose data is likely toregister when the individual's data is in registration and by furthercomparisons with data associated with the other individuals. When thevalue is within predetermined limits for an acceptable value,identification is provided. When the value falls outside thepredetermined limits identification is not provided.

Referring to FIG. 14, a simplified flow diagram of another methodaccording to the invention is shown. Biometric information samples andassociated parameters are provided to a processor. The processorcharacterises the biometric information samples and registers themagainst templates. When the individual's alleged identification isknown, registration is performed against templates associated with theindividual and associated with same biometric information sources.Identification of an individual is performed by evaluating resultingvalues from the registration to determine a quality of useridentification. One aspect of the quality relates to identifiedpotential for false acceptance. In accordance with the invention, thisidentified potential provides information indicative of other enrolledusers who may also be accepted by a same biometric information sampleand, therefore, by registering a current biometric information sampleagainst templates associated with the other enrolled users, some falseidentifications are avoided. When the quality is within predeterminedlimits for an acceptable quality, identification is provided. When thevalue falls outside the predetermined limits identification is notprovided.

Referring to FIG. 15, a simplified flow diagram of another methodaccording to the invention is shown. Biometric information samples froman individual and associated parameters are provided to a processor. Theprocessor characterises the biometric information samples and registersthem against templates. A first set of templates associated with anindividual and associated with same biometric information sources isselected. Registration of the biometric information samples is performedagainst the selected templates producing registration values. Independence upon these values a quality of user identification isdetermined. Such a quality is similar to that described with referenceto FIG. 14. When the quality is within predetermined limits for anacceptable quality, identification is provided. When the value fallsoutside the predetermined limits, identification is not provided and anext set of templates is selected. The selection of the next set isoptionally performed in dependence upon a set of individuals that arelikely to be identified according to the process. Optionally, once allsets of templates are exhausted, an indication of failure to identify isprovided.

Referring to FIG. 16, a two dimensional probability distribution isshown. The total area below the distribution curve is 1 unit area. Usingsuch a curve, false acceptance or false registration is described. Mostbiometric information samples are easily characterized. The high initialpoint on the probability curve and the steep decent to an asymptoticcurve approaching 0 shows this. The line t marks the cutoff forregistration effectiveness. This is determined in dependence upon analgorithm chosen and upon system limitations such as processor speed,memory, and security requirements. The shaded region bounded by Y=0,X>t, and the probability curve represents false acceptances.

Referring to FIG. 17, a truncated two dimensional probabilitydistribution curve is shown. Now, false acceptance is represented by aregion of three dimensional space having a volume of 1 or less units.Upon viewing the graph of actual data for fingerprint biometricinformation, it is apparent that the graph is symmetrical and that thegraph extends toward infinity without reaching the plane z=0. Further,the diagonal center of the surface x=y is a minimum for a given x and y.

A plot showing an acceptance curve for registration is contained belowthe curve of FIG. 17. Here two parameters either from separateregistrations or from a same biometric information sample registrationare evaluated to determine a point. When the point falls below the line,the biometric information is not identified and correspondingly theindividual is not identified. Alternatively, when the point falls withinthe shaded region, registration occurs. Extending this to a plurality ofbiometric information samples results in regions allowing for excellentregistration of some samples with moderate registrations of othersamples. Using a plurality of biometric information samples, allowsequivalent registration algorithms to provide greatly enhanced securityor Alternatively, allows faster and simpler registration algorithms toprovide equivalent security.

In evaluating security of biometric authorization systems, falseacceptance and false rejections are evaluated as a fraction of a userpopulation. A security system is characterized as allowing 1 in 1,000false acceptances or, alternatively, 1 in 1,000,000. Extending the graphof FIG. 18 to n dimensions, results in a different distribution for aregion representing acceptance and, therefore, a match scores of asingle biometric information sample that falls outside the shaded regionof FIG. 17, when combined with several other similarly weak biometricinformation samples, is more likely to fall within an acceptable region.A reasonable correlation among several identifiers is a good indicationof identity. Alternatively, using only a single biometric informationsample, a low match score results in failure to authorize an individual.Likewise, a different individual entering a plurality of biometricinformation samples and trying to gain unauthorized access by, forexample, posing as an authorized individual, is unlikely to match evenlyacross all samples and, whereas a single biometric information samplemay match well, several will not. Further examination of an acceptancegraph shows that excellent match scores of some samples reduce thenecessary match scores for other samples for authorization to occur.

The probability density function is discussed below. Assume aprobability density function, ƒ, of non-match scores exists. That is,

ƒ:R→[0, 1]

and ∫_(R)f = 1

If S={x|x=score(T_(a), T_(b)), where T_(a) and T_(b) arecharacterizations of distinct fingerprints}, then ƒ is 0 outside of S,and ∫_(S)f = ∫_(R)f = 1.

It should be noted that xεS→x≧0 since score is a measure. Ann-dimensional probability density function, g for a sequence ofnon-match scores is constructed by:${{g(P)} = {\prod\limits_{i}^{n}\quad {f\left( x_{i} \right)}}},\quad {{{for}\quad P} \in R^{n}}$

Since each f(x_(i))≦0, then it follows that g(P)≦0 and that∫_(R)f = 1 ⇒ ∫_(R^(n))g = 1

For any subset U⊂S^(n), the probability that a collection of n scores ofnon-matching fingerprints lies in U is given by: ∫_(U)g

Given an n-dimensional probability density function, g, a region, U_(α)⊂S^(n) is defined, bounded “below” by a function, h_(α): R^(n)→R.

U _(α) ={PεS ^(n) |h _(α)(P)≧C _(α)}.

C_(α,) a constant, is calculated such that: ∫_(U_(α))g = α

Thus, given a collection of n fingerprint match scores in the form of apoint P, we determine when PεU_(α) by applying the threshold functionh_(α). Moreover, the probability that such a collection of scoresbelongs to U_(α) is _(α) which can be interpreted as a predeterminedfalse acceptance rate. The criteria

h _(α)(P)≧C _(α)

is used to accept the candidate when true, and reject the candidateotherwise.

Test Case

A large sample consisting of several million non-match comparisons hasbeen generated from a database of fingerprint images in order to createa relative frequency distribution, F(X) of non-matching fingerprintscores. X=score(T_(a), T_(b)), where T_(a), T_(b)ετ are templates ofdifferent fingerprints. Note that the frequency distribution is afunction of a discrete variable. For the purposes of the test case, weassumed that a continuous probability density function, ƒ(x), ofnon-matching fingerprint comparisons exists, and all derivations areperformed for the continuous case. When a calculation was required independence upon actual data, ƒ was approximated by F, and integrationwas replaced by summation.

When we are given a sequence of n non-matching fingerprint scores,{x_(i)}, 1≦i≦n, then an n-dimensional probability density function, g,is derived as follows: Let

P=(x ₁ , x ₂ , . . . , x _(n))

be a particular ordering of the sequence.

Define${{g(P)} = {\prod\limits_{i}^{n}\quad {f\left( x_{i} \right)}}};$

since ∫_(R)f = ∫_(S)f = ∫₀^(∞)f(x)  x = 1

and

R ^(n) =R ^(n−1) ×R

then it follows that $\begin{matrix}{{\int_{R^{n}}g} = {{\int_{R^{n}}{\prod\limits_{i}^{n}\quad {{f\left( x_{i} \right)}{\overset{\_}{x}}}}} = {\int_{R^{n - 1}}{\left( {\int_{R}{\left( {\prod\limits_{i}^{n - 1}\quad {f\left( x_{i} \right)}} \right){f\left( x_{n} \right)}\quad {x_{n}}}} \right){x^{n - 1}}}}}} \\{= {{\int_{R^{n - 1}}{\left( {\prod\limits_{i}^{n - 1}\quad {{f\left( x_{i} \right)}{\int_{R}{{f\left( x_{n} \right)}\quad {x_{n}}}}}} \right)\quad {x^{n - 1}}}} = {\int_{R^{n - 1}}\left( {\prod\limits_{i}^{n - 1}\quad {{{f\left( x_{i} \right)} \cdot \quad 1}{x^{n - 1}}}} \right.}}} \\{= {\int_{R^{n - 1}}\left( {\prod\limits_{i}^{n - 1}\quad {{f\left( x_{i} \right)}\quad {x^{n - 1}}}} \right.}}\end{matrix}$

Repeatedly applying iterated integrals in such a manner, eventuallyresults in ∫_(R^(n))g = 1

When U⊂R^(n), the probability that a collection of n scores ofnon-matching fingerprints lies in U is calculated by iterated integralsover rectangles in R^(n) by: ∫_(u)g = ∫_(R)g ⋅ χu

where U⊂R, and R is a rectangle in R^(n), and χu is the characteristicfunction of the set U ${{\chi u}(P)} = \left\{ \begin{matrix}1 & {P \in U} \\0 & {P \notin U}\end{matrix} \right.$

assuming that χu and ƒ are integrable. In the discrete case, weanalogously define${G(P)} = {\prod\limits_{i}^{n}\quad {F\left( x_{i} \right)}}$

G(P) gives the probability that the n independent scores, {x_(i)} ofnon-matching finger prints occur in a particular sequence. (Note thatg(P) does not give a probability at any specific point since themeasure, and hence the integral, over a single point is zero).

For purposes of calculating false acceptance rates in n-dimensions, wemust attempt to construct regions in R^(n) that have desirableproperties. Suppose that α and β are false acceptance rates. We wouldlike to define regions U_(α), U_(β) ⊂R^(n) such that: $\begin{matrix}{{\int_{U_{\alpha}}g} = {{\alpha \quad {and}\quad {\int_{U_{\beta}}g}} = \beta}} & (1) \\{{U_{\alpha} = \left\{ {{P \in {S^{n}\left. {{h_{\alpha}(P)} \geqq C_{\alpha}} \right\}}},{U_{\beta} = \left\{ {P \in {S^{n}{{{h_{\beta}(P)} \geqq_{\beta}C}}}} \right.}} \right\}}} & (2) \\{\left. {\alpha \leqq \beta}\Rightarrow U_{\alpha} \right. \subseteq U_{\beta}} & (3) \\{{{h_{\alpha}(P)} = \left. C_{\alpha}\Rightarrow{{g(P)} \approx K_{\alpha}} \right.},\quad {{h_{\beta}(P)} = \left. C_{\beta}\Rightarrow{{g(P)} \approx K_{\beta}} \right.}} & (4)\end{matrix}$

The first condition simply defines a false acceptance rate as aprobability. The second condition indicates that regions are boundedbelow by a threshold function where C_(α), C_(β) are non-negativeconstants. The third condition states that when a point is a member of afalse acceptance region with a lower probability, it also belongs to afalse acceptance region associated with a higher probability. One way toachieve this is to have h_(α)=h_(β), (i.e. use the same function) andlet C_(β)≦C_(α). The last condition attempts to ensure that points alongor proximate the region boundaries retain substantially level contourson the n-dimensional probability density function. This reduces unevenboundaries “favouring” certain combinations of match scores.

It is worth noting that corresponding n-dimensional false rejectionrates are calculated assuming that an analogous n-dimensionalprobability density function, g* is constructed from the probabilitydensity function of fingerprint match scores. The corresponding falserejection rate for an n-dimensional false rejection rate _(α) is givenby: ∫_(S^(n) − U_(a))g*

Alternatively, the method is employed with retinal scanned biometricinformation. Further Alternatively, the method is employed with palmprints. Further Alternatively, the method is employed with non imagebiometric data such as voice prints.

One consequence of two different biometric sources is that the abovemath is complicated significantly. As a false acceptance rate forfingerprints may differ significantly from that of voice recognitiondevices or retinal scans, a different f(x) arises for the two lattercases resulting in asymmetric regions. For only fingerprint biometricinformation, ordering of samples is unimportant as false acceptancerates are substantially the same and therefor, the regions defined forregistration are symmetrical as shown in FIG. 18. When differentbiometric source types are used and different functions for falseacceptance result, order is important in determining point coordinatesand an axis relating to voice recognition false acceptance should beassociated with a coordinate value for same.

Referring to FIG. 18, a method of improving security without requiringperformance of additional steps by most individuals is shown. A userpresents biometric information to a biometric input device. Theinformation is characterised and the characterised information ismatched against a template. When a successful registration occurs, dataassociated with the successfully registered template is retrieved andfrom that data, other templates are identified that are similar.Comparison with those templates is performed to determine whether theregistration was unique. When the registration is unique, useridentification is made and the process is complete. When an unsuccessfulregistration occurs, the user is prompted for other biometricinformation. Optionally, the system prompts for each biometricinformation source a plurality of consecutive times.

For example, a user presents their index finger to a fingerprintscanner; registration fails and access is denied. The user againpresents their index finger to the fingerprint scanner; registrationfails and access is denied. The user again presents their index fingerto the fingerprint scanner; registration fails and access is denied. Theuser is prompted to present their middle finger to the fingerprintscanner. Alternatively, the user selects and identifies their middlefinger as the next biometric information source. The registration of themiddle finger is performed according to the invention and therefore isnot a same registration process as when the middle finger is the firstfinger presented to the scanner. The registration relies on the bestregistration value from the index fingerprints and, with theregistration results from the middle finger, determines whetheridentification should proceed. When unsuccessful registration occurs,the middle finger is presented two more times. When registration isstill unsuccessful, another biometric source is requested or is selectedby the user. Optionally, when registration results fall below apredetermined threshold, user identification fails. Alternatively, useridentification fails when known biometric information sources of theuser are exhausted. Of course, whenever a resulting registration valueconsidered with previous registration values according to the inventionresults in a sufficiently accurate identification, data relating to theidentification and indicative of potential errors in identification isretrieved and evaluated. Comparisons with other templates in accordancewith the retrieved data are performed. When the comparisons result in nosubstantial matches, identification of the individual results.Otherwise, further fingerprints are presented to the fingerprint scanneruntil only one substantially correct identification results.

Advantages to this method are that the convenience of currentfingerprint registration systems is retained for a many individuals; fora number of individuals, an extra fingerprint sample from another fingeris required; and, from a small number of individuals, severalfingerprints are required. The number is dependent on fingerprintquality, fingerprint characterisation process, desired level ofsecurity, population size, distinctiveness of biometric information,etc. It is evident to those of skill in the art that when individualsare enrolled, biometric information from a plurality of biometricinformation sources is provided, characterised and associated/storedwith their identification.

Because of the nature of, for example, fingerprints, the use of multiplefingerprints from a same individual provides an additional correlationas discussed herein. In an embodiment, with each fingerprint presented,analysis and registration provides one of three results—identified,rejected, unsure. When unsure, more biometric information is requested.The individual provides additional fingerprint data and again one of thethree results is provided. When a final identification or a rejectionoccurs, the process stops. Optionally, a log of access attempts ismaintained for later review.

In a further refinement of the embodiment, the processor prompts a userfor their identity. When the user provides identification, biometricinformation is requested from sources in an order that is most likelydeterminative of the user identity.

For example, when biometric information from an index finger is providedand registered but fails to sufficiently identify the user, furtherbiometric information is requested. The biometric information requestedis selected such that a highest likelihood of identification results.Alternatively, the biometric information source is selected such that ahighest likelihood of rejection results. Should the next sample ofbiometric information fail to be determinative—identification orrejection, further biometric information from another source isrequested again attempting to make a final determination fastest.

When a user identity is not provided, a data structure indicating a nextbiometric information source to request is produced from all biometricinformation. In dependence upon a registration value of a currentbiometric information sample, user identification, rejection, orrequesting further biometric information results. In the latter case,the requested information is determined based on the known biometricinformation and registration values associated therewith. For example,biometric information is provided from a first biometric informationsource. Registration is performed and is inconclusive. It is determinedthat a particular biometric information source comprises informationmost likely to result in identification or failure thereby beingdeterminative; that biometric information source is polled.

When selecting subsequent biometric information sources, preferably, allpossible outcomes are analysed and the outcome of failed identificationis not itself considered a single outcome but is weighted more heavily.The advantages to this approach are evident from the example below.

In another example for use in identifying individuals by searching adatabase of enrolled individuals, biometric information is provided froma right thumb. Registration is performed and is inconclusive determiningthat the right thumb is likely that of John, Susan, or Peter but mayalso be that of Jeremy, Gail, or Brenda. Reviewing data associated withJohn, Susan, or Peter, it is determined that Joe is sometimes confusedwith each of these three. A next biometric information source isselected such that clear discrimination between the individuals resultsand a likely identification will occur. The next biometric informationsource is one that easily eliminates a large number of the potentialindividuals. In this example, the right ring finger is selected becauseSusan and Peter have very distinctive ring fingers. Biometricinformation from the right ring finger is provided and registered withtemplates in the database. Though the right ring finger is most likelythat of Jim or Susan, it is evident that Susan, appearing in both lists,is the front runner. Data associated with Jim is retrieved and it isdetermined that Susan is sometimes erroneously identified as Jim. Also,the registration result for Peter is sufficiently low that it isunlikely that Peter is the individual. Though neither registration valuewould identify Susan on its own with the desired level of security, whenthe two registrations are taken together, Susan is indeed identified.Alternatively, when the resulting list is still not conclusive—two ormore people identified or no one identified with sufficient certainty,further biometric information from another biometric information sourceis requested.

The data is arranged such that in dependence upon previous registrationresults a next biometric information source is polled. Using such asystem, searching large databases for accurate registration isfacilitated and reliability is greatly increased. Preferably, thedatabase is precompiled to enhance performance during the identificationprocess.

In another embodiment, templates are formed by characterising aplurality of fingerprints of an individual and constructing a singlecomposite template comprising fingerprint information from eachfingerprint. Using such a composite template, identification ofbiometric information sources is obviated. For example, an individualprovides a fingerprint to a biometric imaging device. The imagedfingerprint is provided to a processor. The processor need not beprovided with information regarding the biometric source—the exactfinger—in order to perform template matching. The fingerprint isregistered with a single composite template to produce a registrationvalue. The registration value is used to identify the individual, promptthe individual for another fingerprint, or reject the individual.

Methods of forming composite templates include selecting a plurality offeatures from each fingerprint, selecting similar features from eachfingerprint, forming a data structure indicative of fingerprintidentification and indicative of features, etc. In an embodiment a datastructure comprises a first feature to verify. When present, a nextfeature or set of features is verified. When absent a different featureor set of features is verified. By providing the data in a treestructure such as a binary tree, finger and registration values areidentified simultaneously. Also, a data structure allows for compilationof a known group of biometric information, e.g. 10 fingerprints, for usewith the present invention wherein identification is dependent upon aplurality of different biometric information samples.

Alternatively, single composite templates having a plurality of featuresfrom each fingerprint are formed by mapping selected features andinformation regarding the features into the composite template. Thisallows for a processing of the template against a characterisedfingerprint to produce a registration value. Often, the registrationprocess using composite templates is different from that usingindividual templates.

Another method of forming composite templates is to form templateshaving finer and finer resolutions each associated with a smaller groupof templates. For example, a first coarse template determines whether ornot to match the characterised fingerprint against other finertemplates. In use, a fingerprint is compared against coarse templates.When a match within predetermined limits occurs, finer templatesassociated with the coarse template are also matched against thefingerprint. When the match is not within predetermined limits, thefiner templates associated with the coarse templates and all finertemplates associated therewith are excluded from further matching. Thisimproves performance of the individual identification system.

The arrangement of data for the present method is similar to that of atree structure. A coarse template may be a same template for differentfiner templates. Therefore, registration is performed against a smallnumber of coarse templates in order to limit the number of finertemplates. The process is repeated at each node of the tree until anidentification of the individual or until a most likely node isdetermined. Further biometric information from a different biometricinformation source is registered in a similar fashion. Because each nodeas one descends throughout the tree structure toward the leaves isrelated to fewer individuals, an intersection of potential individualsfrom each search determines potential identifications. Preferably, morethan one potential node is identifiable with each biometric informationsource. For example, registration of the index finger results in aselection of two nodes—a and b. Each node is associated with a number ofindividuals. Registration of the middle finger is associated with threedifferent nodes—c, d, and e. An intersection (a∪b)∩(c∪d∪e) results inpotential identifications. When the intersection contains a small numberof individuals, registration against individual templates is performedaccording to the method and using each biometric sample provided from adifferent biometric information source in order to identify theindividual with a predetermined level of security.

Of note, when using different biometric information sources, anasymmetric probability distribution results. This often makesdetermination of threshold functions more difficult. In an embodiment,when an asymmetry exists in the probability distribution function,weighting of registration values is used. This allows for balancing ofinconsistencies in registration processes for different biometricinformation sources or, alternatively, more emphasis on certainbiometric information sources than on others.

Numerous other embodiments may be envisaged without departing from thespirit and scope of the invention.

What is claimed is:
 1. A method of identifying an individual comprisingthe steps of: a) receiving a biometric information sample from abiometric information source of the individual; b) characterising thebiometric information sample; c) comparing the characterised biometricinformation sample against some of a plurality of stored templates toidentify a template that closely matches the characterised biometricinformation sample, wherein some templates belong to differentindividuals; d) based upon data stored associated with the identifiedtemplate and indicative of further templates relating to differentindividuals from the plurality of stored templates that are each similarto the identified template and are potentially confusing therewith,determining further templates relating to further individuals differentfrom the individual to which the identified template relates; e)verifying the identified template by performing the step of comparingthe characterised biometric information sample against a template fromthe further templates to determine a likelihood that the characterisedbiometric information sample closely matches the template from thefurther templates; and f) identifying the individual based on theidentified template when a match between the characterised biometricinformation sample and the template from the further templates has alikelihood outside a first range of likelihoods.
 2. A method ofidentifying an individual as defined in claim 1 wherein the step ofcomparing the characterised biometric information sample against atemplate from the further templates to determine a likelihood that thecharacterised biometric information sample closely matches the templatefrom the further templates is performed for each template from thefurther templates and wherein the step of identifying the individual isperformed when each of the determined likelihoods is outside a firstrange of likelihoods.
 3. A method of identifying an individualpresenting a biometric information sample to a system as defined inclaim 1 comprising the step of: prompting the individual to present thebiometric information source when the likelihood is within a first rangeof likelihoods.
 4. A method of identifying an individual presenting abiometric information sample to a system as defined in claim 1comprising the step of: prompting the individual to present a furtherdifferent biometric information source when the likelihood is within afirst range of likelihoods.
 5. A method of identifying an individualpresenting a biometric information sample to a system as defined inclaim 4 wherein the first biometric information source is a fingertipand the further biometric information source is a fingertip from adifferent finger of the individual.
 6. In a system wherein biometricdata are stored in a database, a method of performing one of userauthorisation and user identification comprising the steps of: a)providing a biometric information sample; b) comparing data based on thebiometric information sample and the biometric data to locate data ofdifferent individuals within the biometric data that is indicative of asubstantial match with the biometric information sample; c) determiningfurther data from data associated with the located data indicative of asubstantial match, the further data indicative of biometric datarelating to individuals other than an individual to whom the locateddata indicative of a substantial match relates that has a knownpotential for allowing determination of a false acceptance betweenbiometric data and the located data; d) verifying the identifiedtemplate by performing the step of comparing the data based on thebiometric information sample and the further data from the database toprovide comparison results indicating likely data that is a substantialmatch and likely data that is not a correct substantial match and wouldresult in a false acceptance; and, e) when the comparison results areindicative of one substantial match with the biometric informationsample, performing at least one of user authorisation and useridentification in dependence upon the one substantial match.
 7. A methodof performing one of user authorisation and user identification asdefined in claim 6 comprising the step of: when the comparison resultsare indicative of a further substantial match with the biometricinformation sample, prompting for a further biometric informationsample.
 8. A method of performing one of user authorisation and useridentification as defined in claim 7 wherein the further biometricinformation sample is a biometric information sample from a differentbiometric information source.
 9. A method of performing one of userauthorisation and user identification as defined in claim 6 wherein thestep of comparing data based on the biometric information sample and thebiometric data is performed only until a first comparison indicative ofa substantial match with the biometric information sample results.
 10. Amethod of performing one of user authorisation and user identificationas defined in claim 6 wherein the step of performing at least one ofuser authorisation and user identification comprises performing useridentification.
 11. In a system wherein biometric data are stored in adatabase, a method of identifying comparisons indicative of potentialfalse acceptance comprising the steps of: comparing data based on abiometric information sample associated with first data within thebiometric data and the biometric data to locate second data related toanother individual within the biometric data that is indicative of asubstantial match with the biometric information sample to providecomparison results; and, when a comparison result is indicative of asubstantial match and the second data is other than the first data,storing information in association with the first data the informationindicative of the second data.
 12. A method of identifying comparisonsindicative of potential false acceptance as defined in claim 11 whereinthe step of comparing data is performed until the biometric informationsample is compared with the biometric data to identify each possiblematch.
 13. A method of identifying comparisons indicative of potentialfalse acceptance as defined in claim 11 wherein a substantial match is acomparison wherein the likelihood of a match is above a predeterminedthreshold.
 14. A method of identifying comparisons indicative ofpotential false acceptance as defined in claim 11 wherein theinformation is indicative of identification.
 15. A method of identifyingcomparisons indicative of potential false acceptance as defined in claim11 wherein the biometric data comprises templates derived from biometricinformation, the templates for comparison with captured biometric data.16. A method of storing data relating to biometric information in adatabase for use in identifying individuals comprising the steps of:storing data associated with a first biometric information sample and acorresponding identification of an individual; and, storing a list ofdata associated with other biometric information samples correspondingto identifications of other individuals within the database, some of thebiometric data associated with the other biometric information sampleshaving a significant similarity to data associated with the firstbiometric information sample.
 17. A method of storing biometricinformation in a database for use in identifying individuals as definedin claim 16 wherein the biometric information is fingerprint data.
 18. Amethod of registering biometric information from a source, comprisingthe steps of: a) providing an instance of biometric information from thesource; b) storing a template relating to the provided biometricinformation in a database comprising a plurality of templates; c)comparing the biometric information against a further template of adifferent individual to determine a likelihood that the biometricinformation matches the further template; d) when the likelihood iswithin a first range of likelihoods, storing data relating to thefurther template for use in distinguishing between the stored templateand the further template to potentially reduce a number of falseacceptances and false rejections in association with the data based onthe biometric information.
 19. A method of registering biometricinformation from a source as defined in claim 18 comprising the step ofstoring the determined likelihood that the biometric information matchesthe further template in association with the data relating to thefurther template.
 20. A method of storing biometric information in adatabase for use in identifying individuals as defined in claim 18wherein the biometric information is fingerprint data.
 21. A method ofregistering biometric information in a database for use in identifyingindividuals as defined in claim 18 comprising: providing a plurality ofdifferent instances of a same biometric information of an individualfrom the biometric input device to a processor; selecting each instanceof the plurality of different instances; for each selected instancecomparing that selected instance with other of the different instancesof a same biometric information provided by the individual, anddetermining a registration value corresponding to similarities ordifferences between each selected instance; and, selecting as thebiometric template an instance from the plurality of different instancesfor which the registration value is within predetermined limits.
 22. Amethod of registering biometric information from a source as defined inclaim 18 comprising the step of: when the likelihood is within the firstrange of likelihoods, storing data relating to a biometric informationsource selected so as to distinguish between the provider of thepreviously stored biometric information and the provider of thebiometric information from which the further template is determined. 23.A method of registering biometric information from a source, comprisingthe steps of: a) providing an instance of biometric information from thesource; b) storing a template relating to the provided biometricinformation in a database comprising a plurality of templates; c)comparing previously stored biometric information of differentindividuals against the stored template to determine a likelihood thatthe previously stored biometric information related to a differentindividual matches the stored template; and, d) when the likelihood iswithin a first range of likelihoods, storing data relating to thepreviously stored biometric information and related to a differentindividual associated with the data based on the biometric information.24. A method of registering biometric information from a source asdefined in claim 23 comprising the step of storing the determinedlikelihood that the biometric information matches the further templatein association with the data relating to the further template.
 25. Amethod of storing biometric information in a database for use inidentifying individuals as defined in claim 23 wherein the biometricinformation is fingerprint data.
 26. A method of registering biometricinformation from a source as defined in claim 23 comprising the step of:when the likelihood is within the first range of likelihoods, storingdata relating to a biometric information source selected so as todistinguish between the provider of the previously stored biometricinformation and the provider of the biometric information from which thestored template is determined.